CVE-2021-45876

9.8 criticalEPSS 1.5%

Critical (9.8) in garo. EPSS 1.5% chance of exploitation in the next 30 days.

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2022-03-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

garo:wallbox_glb_firmware
garo:wallbox_gtb_firmware
garo:wallbox_gtc_firmware

References

https://github.com/delikely/advisory/tree/main/GARO
https://github.com/delikely/advisory/tree/main/GARO

Check your stack JSON